test(secrets): cover per-bottle egress secret encryption
test / integration-docker (pull_request) Failing after 33s
tracker-policy-pr / check-pr (pull_request) Failing after 30s
test / integration-firecracker (pull_request) Successful in 3m18s
test / unit (pull_request) Failing after 11m40s
lint / lint (push) Failing after 11m46s
test / coverage (pull_request) Has been skipped
test / publish-infra (pull_request) Has been skipped

Add unit coverage for the encrypted at-rest egress secrets: the
secret_store round-trip (new_env_var_secret/encrypt_value/decrypt_value)
and the registry/service wiring that injects ENV_VAR_SECRET.

Recovered from the bot-bottle-claude-agent-1 VM after the CI runner's
disk filled and forced its rootfs read-only; committed work was already
on origin, these were the agent's uncommitted changes.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
2026-07-21 22:23:18 -04:00
parent c40d359b3d
commit 350b1def0d
3 changed files with 149 additions and 0 deletions
+1
View File
@@ -13,6 +13,7 @@ from unittest.mock import patch
from bot_bottle.orchestrator.broker import LaunchBroker, LaunchRequest, StubBroker
from bot_bottle.orchestrator.registry import RegistryStore
from bot_bottle.orchestrator.secret_store import new_env_var_secret
from bot_bottle.orchestrator.service import Orchestrator
from bot_bottle.orchestrator.gateway import Gateway
from bot_bottle.store_manager import StoreManager